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Suspicious Activity Reporting 


Process Implementation Checklist 


e AN IMPORTANT INITIATIVE FOR YOUR COMMUNITY 


The suspicious activity reporting (SAR) process focuses on what law 
enforcement agencies have been doing for years—gathering information 
regarding behaviors and incidents associated with crime and establishing 
a process to share information to detect and prevent criminal activity, 
including crime associated with domestic and international terrorism. 
Implementation of the SAR process can be accomplished within the 
agency’s existing framework to gather, document, process, analyze, and 
share behaviors and events that are indicative of criminal activity. 


After the horrific events of September 11, 2001, agencies 
at all levels of government recognized the risks that can 
result from not sharing information, as well as the value 
cen te" ine and benefits of sharing critical information—‘connecting 
the dots.” The National Strategy for Information Sharing 
(NSIS) was subsequently developed to establish, in part, 
OQ a nationwide vision for the sharing of suspicious activity. 
+ One of the tasks for the federal government, as identified in 
the NSIS, is to “establish a unified process to support the 
reporting, tracking, processing, storage, and retrieval” of 
suspicious activity reports. 


In an effort to implement the tenets of the NSIS, state, local, tribal, 
territorial, and federal agencies have partnered to develop a nationwide 
SAR capability. To meet these requirements, an end-to-end process—the 
gathering, processing, reporting, analyzing, and sharing of suspicious 
activity—was adopted by major national law enforcement organizations. 
This process, also referred to as the SAR process, is graphically 
depicted on pages 4 and 5. Akey goal of this process is ensuring that 
behavior which may be indicative of terrorist activity is shared with 


fusion centers and Joint Terrorism Task Forces (JTTF) in an expedited 
manner so that broad partnership resources can be leveraged as quickly as 
possible. 


All agencies, regardless of size or jurisdiction, have a role in the nationwide 
SAR process. It is essential that state, local, tribal, territorial, and federal 
agencies work together to share SAR information in order to prevent and 
deter another terrorist attack on American soil. 


Using this checklist in developing an internal SAR process will aid agencies 
in their crime prevention efforts and assist with successfully incorporating 
state, local, tribal, and territorial agencies into the nationwide SAR process. 


Included at the end of the checklist is an overview of the SAR sharing 
concept—which is a solution to sharing SAR data among state, local, 
tribal, territorial, and federal agencies—as well as a listing of benefits for 
participating in the nationwide SAR process. 


This document, a companion to the 
Findings and Recommendations of the 
Suspicious Activity Report (SAR) Support 
and Implementation Project, provides a 
simple checklist for chief executives and 
senior leadership to implement a SAR 
process within their agency. 
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SAR Cycle CHART 


As shown in the diagram below, certain steps—highlighted 
in red—in the SAR process focus on the activities of state, 
local, tribal, and territorial agencies. By following these steps, 
agencies can be assured that their SAR activities are in 
alignment with and can support crucial information sharing. 
This diagram will also help identify gaps in an agency’s current 
process that may need to be addressed and/or corrected. 
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LEADERSHIP Must RECOGNIZE 


THE IMPORTANCE OF 
IMPLEMENTING A SAR PROCESS 


The chief executive and agency leadership must recognize 
the importance of implementing a SAR process within their 
agency and champion the efforts of the SAR process and the 
Nationwide SAR Initiative (NS/) both inside and outside the 
agency. 


Closely collaborate with partners such as fusion centers, homeland 
security officials, JTTFs, and the eGuardian program. 


Brief command staff/senior management on the SAR 
implementation process, to include policy development; privacy, 
civil rights, and civil liberties protections; technology; training; and 
community outreach. 


Assign primary responsibility for implementing the SAR process to 
a command-level position. 


Provide training to command staff/senior management on the 
implementation of the SAR process using agency training or 
programs already developed. 
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_ IDENTIFY EXISTING SAR 
PROCESSES AND DETERMINE 


WuHat SAR PrRocEssEs NEED 
TO BE DEVELOPED 


Examine the agency’s business process to identify current SAR 
processes in place, and determine what to develop and/or 
enhance. Develop an order/Standard Operating Procedures 
(SOPs) directing the gathering, processing, reporting, analyzing, 
and sharing of suspicious activity. Leverage the use of national 
standards, and incorporate national guidelines into the 
business process and agency SOPs. 


Review other agencies’ SAR process mission/SOPs to better 
understand the process and to identify promising practices to assist 
in the development of the agency policy and mission statement. 


Simplify the reporting process by modifying agencies’ current 
reports—basic incident report, offense report, information 
report, or field interview report—to include fields to capture 
SAR data (consider using one report as the primary intake for 
standardization). 


Identify and establish intake points for the collection and receipt of 
SARs (one centralized location). 


Develop an electronic means or modify the current system (i.e., 
records management system [RMS]) to gather, process, report, 
analyze, and share SAR data within the agency in real time. 


>. INCORPORATE NATIONAL 
| GUIDELINES INTO STANDARD 


OPERATING PROCEDURES 


Adopt the standardized behavioral-specific codes used to identify 
SARs, located in the Information Sharing Environment (ISE) 
Functional Standard (FS) Suspicious Activity Reporting (SAR). 


Define a process for forwarding data to the urban area, regional, or 
statewide fusion center and JTTF. 


Ensure that SARs receive an initial vetting within 24 hours of being 
reported. 


Develop a method for determining disposition of SAR data (e.g., 
whether to respond, refer, determine unfound, or take other action). 


Develop a system for retrieving SAR data. 


Develop a mechanism for providing timely feedback to the original 
submitter of the SAR information. 
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*, IMPLEMENT AN AGENCY 


-| Privacy POLiIcy 


Develop and/or enhance and implement an agency privacy 
policy to ensure that privacy, civil rights, and civil liberties are 
protected when performing all steps of the SAR process. 


Use legal/privacy advisors when developing the agency’s privacy, 
civil rights, and civil liberties protection policy. 


A template for developing a privacy policy is available at 


http://www.it.ojo.gov/fusion_ center privacy policy template. Note 
the SAR provisions contained in this template. 


Promulgate the SAR privacy policy agencywide to stress the 
importance of privacy, civil rights, and civil liberties protections 
during the SAR process and within the agency. 


Ensure that the privacy policy is transparent and communicated 
with the public, community organizations, and other groups as 
appropriate. 


“TRAIN ALL AGENCY PERSONNEL 


ON THE SAR PROCESS 


Training is a vital component of an agency’s SAR process 
implementation. Personnel at all levels should receive training 
on the SAR process to ensure that it is institutionalized within 
the agency. 


Develop a framework and timetable for training all personnel within 
the agency. 
Focus training on: 


The importance of privacy, civil rights, and civil liberties 
protections. 


The gathering of suspicious activity information through 
behavior-based policing. 


Behavior-based policing includes behaviors and/or 
incidents known to be exhibited by terrorists that would be 
collected in a terrorism-related suspicious activity report. 


The mechanism for reporting suspicious activity 
(standardization). 


The processing of SARs within the agency. 
The steps in analyzing the SAR data. 


The appropriate sharing of suspicious activity information 
within and outside the agency. 


Implement an evaluation program for modifying and enhancing the 
SAR training program based on emerging trends, lessons learned, 
and identified gaps. 


Ensure that all officers review the SAR Line Officer Training video 
at http://nsi.ncirc.gov/training online.aspx. 
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INSTITUTIONALIZE THE SAR 
» |_| Process WITHIN THE AGENCY 


Once an agency’s SAR process is developed, continuous 
improvements will ensure the integrity and institutionalization 
of the process within the agency. Criminals are continually 
modifying their methods, and law enforcement operations must 
also continue to adapt to meet these changes. 


Develop a liaison officer program to ensure that terrorism-related 
suspicious activity is being gathered and reported to the proper 
personnel, local JTTF, and fusion center. 


Conduct periodic audits of SAR data by command-level staff or 
designees. 


Develop qualitative and quantitative measures on the SAR process 
to gauge effectiveness (management accountability reports). 


Modify the agency SAR process based on Priority Information 
Needs (PINs) for emerging trends/behaviors. 


Incorporate the SAR process into the development of alerts, 
warnings, notifications, and other relevant reports for critical 
infrastructure and key resources. 


*, EDUCATE THE COMMUNITY 


ON THE SAR PROCESS 


Educate the community on the SAR process to ensure 
transparency and openness and to elicit their support. 


Provide educational outreach to the public regarding the SAR 
process and policies through initiatives such as: 


Internet-based newsletters 

E-mail notifications to stakeholders 

Media commercials 

Officer-to-citizen interaction programs 

Distribution of CDs and DVDs related to the reporting of 
suspicious activity 

Community awareness training 
Informational flyers 

“If You See Something, Say Something 
campaign 


™99 


public awareness 


Consider instituting a Building Community Partnerships program 
to engage with and develop productive relationships with the 
critical sector and community stakeholders your agency serves to 
enable partnerships in the protection of critical infrastructure and 
the prevention of crime and terrorism. Guidance can be found at 
https://nsi.ncirc.gov/documents/building_ community partnerships. 
pdf. 


Use other online training programs for homeland security partners, 
such as private sector security and other government first 
responders. These programs can be found at http://nsi.ncirc.gov 
/training_online.aspx. 


Partner with other law enforcement agencies, public safety, 
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*, PARTNER WITH OTHERS AND 


| CONNECT TO INFORMATION 
SHARING NETWORKS 


public health, and external stakeholders. Connect to 
nationwide law enforcement information sharing networks. 


Inform external stakeholders (mayor, city council, legislature, etc.) 
on the SAR process to gain their support. 


Provide educational outreach and develop partnerships with public 
safety (fire, emergency management services, health agencies, 
etc.) and the private sector (financial institutions, private security, 
power plants, etc.) regarding the SAR process. 


Become a member of a secure law enforcement network, 

such as the Regional Information Sharing Systems® Secure 
Cloud (RISSNET™), the Federal Bureau of Investigation’s Law 
Enforcement Enterprise Portal (LEEP), or the U.S. Department 
of Homeland Security's Homeland Security Information Network 
(HSIN). 


Access the state’s criminal justice network (if available). 
Access the state or regional intelligence database (if available). 


Access the state or regional fusion center (if available). 


Ensure that the agency has the ability to send and receive secure 
e-mail. 


Develop the ability to export RMS data in the National Information 
Exchange Model (NIEM) Extensible Markup Language (XML) 
format for SARs. 


Continue to collaborate with nationwide partners such as fusion 
centers, homeland security officials, JTTFs, and the eGuardian 
program. 


View the online SAR training for law enforcement and hometown 
security partners at http://nsi.ncirc.gov/training_online.aspx. 
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‘ Py ISE SHARED SAR 
* '—— SOLUTIONS 


The Nationwide Suspicious Activity Reporting Initiative (NSI) SAR Data 
Repository (SDR) is a decentralized distributed data model used to make 
standardized terrorism-related information available through Common 
Terrorism Information Sharing Standards applications and services. 


Developing a SAR process and involvement in the NSI SDR will enable 
fusion center users to access federal, state, local, tribal, territorial, and 
regional SAR data. The NSI SDR provides an easy solution for fusion 
centers to share terrorism-related suspicious activity information, while still 
maintaining local control of SAR data collected from local agencies. 


Law enforcement agencies are able to share information with other 
agencies via the NSI SDR. Each agency has control of the information it 
makes available for sharing. The NSI SDR is made available for search by 
authorized user agencies via a secure network. 


°, BENEFITS OF ESTABLISHING OR 


| ENHANCING A SAR PROCESS 


Benefit from the ability to view other jurisdictions’ information to 
assist them with their local efforts in identifying and preventing 
criminal activity related to terrorism. 


Further develop intelligence-led policing models. 


Apply the SAR data to the COMPSTAT process for management 
accountability and resource allocation. 


COMPSTAT (COMPuter STATistics) is an accountability 
process—developed originally by the New York City Police 
Department and adopted by many law enforcement agencies 
around the country—that uses crime statistics to drive decision 
making on the deployment of resources and provides a 
methodology to measure police activity. 


Apply geospatial visualization of SAR data to assess relationships 
to critical infrastructure and key resources. 


Enhance analytic capabilities to better identify linkages. 


Enhance analytic capabilities to track SAR activity by date, time, 
and/or location. 


SAR ADDITIONAL 


RESOURCES 


For additional resources on the SAR process, please visit the Nationwide 
SAR Initiative (NSI) Web site at . The NSI Web 

site serves as the central location for resources, training, and contact 
information on developing a SAR process within an agency. 


The NSI Web site includes information on: 
>» NSI partners 
>» Online SAR training 
» On-site SAR training 


» Overview and implementation resources 


National Strategy for Information Sharing 


National Strategy for Information Sharing and Safeguarding 


Findings and Recommendations of the Suspicious Activity Report 
(SAR) Support and Implementation Project 


Information Sharing Environment (ISE) Functional Standard (FS) 
Suspicious Activity Reporting (SAR) 


National Information Exchange Model 


Assistance with privacy policy development at: 


Additional resources and publications on the Nationwide SAR Initiative or 
the SAR process can be located at: 
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